Auphan Online Data Breach
The 2017 Auphan Online data breach occurred in August 2017 when unauthorized threat actors breached the online portal infrastructure of Auphan Online (auphanonline.com / auphansoftware.com), associated with Vancouver-based enterprise restaurant POS and hospitality management vendor Auphan Software.
Exposed Data Types
3- Email addresses
- Usernames
- Passwords
About This Breach
The incident exposed user accounts, unsalted cryptographic credentials, and portal profile identifiers.
What information was affected in the Auphan Online incident?
The leaked database export of the engine2_engine_users table compromised 46,717 unique user profiles, exposing the following categories of personal information:
- Contact Credentials: Canonical email addresses.
- Account Identifiers: Account usernames.
- Security Credentials: Unsalted MD5 cryptographic password hashes.
How many accounts were affected?
Comprehensive deduplication and validation confirmed 46,717 unique canonical email addresses across 46,953 raw user records.
Technical analysis and security risks
The use of legacy unsalted MD5 hashes left the stored passwords highly vulnerable to rapid plaintext inversion via precomputed rainbow tables and brute-force dictionary attacks. In combination with valid email addresses and usernames, this creates severe exposure to automated credential stuffing against corporate email, payment gateways, and personal accounts.
Recommended actions for affected users
Users who maintained accounts with Auphan Online or associated portals should:
- Immediately update passwords on any existing accounts where credentials from that era may have been reused.
- Adopt password management software to maintain strong, unique credentials across every service.
- Enable multi-factor authentication (MFA / 2FA) across all administrative and personal digital identities.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
